L4 DDoS Management

L4 DDoS Management is the tab on which the whole L4 DDoS configuration of a route table is gathered. The screen is not a list of forms but a summary surface that consists of rule rows: every row tells the state in force of a rule with a full sentence.

The purpose of this design is to make the configuration readable. An administrator looking at the screen reads sentences instead of field names: how many packets per second a source can send, what happens if it exceeds that, which packets are not accepted at all and who is kept outside these rules are seen on a single screen.

The editing is gathered in the rule rows: the pencil icon in the row opens the window of that rule. The bands have no editing element of their own; of the boxes, only the Whitelist & Known Peers box carries its own pencil, because it consists of a single setting. The learning settings, on the other hand, are opened from the first card of the learning strip.

Accessing the Screen

Left Monitor Panel is opened.
Route Tables & L4 DDoS is selected from the category tabs at the top left.
The route tables defined on TR7 are listed.
The route table to be configured is clicked; the screen opens with the Dashboard tab that carries the name of the route table.
On the screen that opens, the L4 DDoS Management tab is clicked.

Screen Structure

The screen consists of three layers from top to bottom.

Layer	Content
L4 DDoS Protection Mode	The first band of the screen. On the left there is the protection status of the route table (Active, Monitoring or Not Active), and at the top right the mode distribution badges of the rules. In the body of the band there are the three boxes that stand above all the rules: Blacklist, Quarantine and Whitelist & Known Peers.
Learning	The learning strip. It summarizes in three cards how the engine learns, how it evaluates the settings in force and the recommendations ready to be applied. The operation that returns all the protection rules to their default values is also on this strip; the learning settings are not affected by this operation.
Protection bands	The rules of the five bands, one under the other in catalog order: TCP, UDP, ICMP & Reflection, Packet Integrity and TR7 Management Access. In the header of every band there are its name, the number of rules and the mode distribution; in its body there are the boxes and the rule rows.

The status on the strip is not a setting

The Active, Monitoring or Not Active text on the protection mode strip is not a working mode selected manually but a reading derived from the modes of the rules. The modes are changed from every rule's own editing window; in addition, when a promotion recommendation of the learning engine is applied, a rule can be raised from monitoring to enforcement.

The strip takes into the jury only the rules that use the enforcement levels. The settings with an on/off structure are written into the badges of the bands but do not enter the number of the strip; for this reason the two numbers may not match.

Rules are not added, they are adjusted

There is no rule adding or deleting operation on the screen. The rule catalog is fixed and is displayed with the same rules in every route table; what can be done is to adjust the mode of every rule, its threshold values if there are any, and the learning lock.

The only exception is the TR7 Management Access band: it is displayed only in the DEFAULT route table of the device, it is not displayed at all in the other route tables.

The catalog defaults are in force from day one

The defaults defined in the catalog are written to the table while the route table is being created and in the configuration check at device startup. For this reason, in a route table that has never been touched as well, a part of the rules runs in enforcement and a part in monitoring, and they produce measurements.

When a rule is saved, all the L4 DDoS fields of the route table are written again; the fields whose value remains undefined are filled with the catalog default.

What Is Done Where?

Purpose	Path
To pass a rule from monitoring into enforcement	The pencil in the rule row → the `Status` field of the window that opens
To limit a handshake flood	The rate rule in the SYN Flood box
To limit the number of open connections per source	Connection Abuse
To stop the scan and malformed flag patterns	Malformed Flags & Scans
To limit the UDP flood and the DNS requests	UDP Flood
To allow or close ICMP traffic	ICMP
To limit the reflected amplification traffic	Reflection & Amplification
To drop the sessionless and spoofed source packets	Malformed Packets
To put a concurrency ceiling on the management access	Management Ports
To keep one's own infrastructure outside the rules	Whitelist & Known Peers
To see those in the penalty box and release them	The table link in the Quarantine box
To select how the reputation blacklist will be applied in this table	Blacklist
To review and apply the recommended settings	The Learning strip
To return all the protection rules and the exemption list to the default	The operation on the What It Can Do for You card

Not everything is on this tab

What the rules do is read not on this screen but on the neighboring tabs: the measurements and the graphs are on Dashboard, the sources dropped and taken into quarantine at that moment are on L4 DDoS Live View, and the sources taken into quarantine in the past are on the Quarantine History tab.

The route table itself is not created here either; the tables are managed from the Route Tables screen.